feat: expand backup to all data and add automatic scheduled backups

Backup export/import now covers Role, User, RolePermission,
Notification, AuditLog and Document (with actual file content), not
just business data - matching "wirklich alle Daten". Role/User use
natural keys (role.key, resource+action) so a bundle restores cleanly
into a different database.

Adds BackupSchedulerService (@nestjs/schedule) for cron-based automatic
backups to a local path (BACKUP_STORAGE_PATH), with retention pruning
and a file-mtime guard against duplicate runs across replicas. New
GET /backup/schedule and POST /backup/schedule/run-now endpoints, plus
a status card and manual trigger in the frontend Backup settings page.

deploy/k8s/backend/configmap.example.yaml

@@ -8,6 +8,12 @@ data:
   JWT_REFRESH_EXPIRES_IN: "7d"
   FRONTEND_ORIGIN: "https://apicore.example.com"
   DOCUMENTS_STORAGE_PATH: "/data/documents"
+  # Automatische Backups. Ohne BACKUP_STORAGE_PATH bleibt der Zeitplan
+  # deaktiviert. Bei >1 Replica muss dies auf ein geteiltes Volume zeigen,
+  # wie DOCUMENTS_STORAGE_PATH.
+  BACKUP_STORAGE_PATH: "/data/backups"
+  BACKUP_CRON_SCHEDULE: "0 3 * * *"
+  BACKUP_RETENTION_COUNT: "14"
   COOKIE_SECURE: "true"
   # Entra ID SSO. Issuer ist die v2.0-Metadaten-URL des Tenants,
   # Redirect-URI muss exakt der im App-Registrierung hinterlegten entsprechen.